TweakTown
Tech content trusted by users in North America and around the world
5,671 Reviews & Articles | 36,049 News Posts

US-Cert says Microsoft got fix wrong

Dissabling AutoRun not effective

| Posted: Jan 22, 2009 3:36 pm

Microsoft may be misleading users as to an effective method for dealing with the W32.Downadup worm that is spreading quickly around the web.

 

In a KB article MS explains that simply disabling AutoRun is an effective solution; US-CERT disagrees and says that this is an ineffective workaround.

 

AutoRun and AutoPlay are functions within Windows that allows newly attached drives and other media to play without user intervention.
This is usually down to an Autorun.inf which contains information on what to do when the disk or drive is accessed.
For example (taken from an Office 2003 CD-ROM)
[autorun]
OPEN=SETUP.EXE /AUTORUN
ICON=SETUP.EXE,1

 

shell\configure=&Configure...
shell\configure\command=SETUP.EXE

 

shell\install=&Install...
shell\install\command=SETUP.EXE

 

The code tells the computer to run certain applications when inserted or when accessed through double clicking.

 

Cert has a method to properly disable AutoRun but users are still cautioned to have good malware protection.

 

Read more here.

 

US-Cert says Microsoft got fix wrong

The Autorun and NoDriveTypeAutorun registry values are both ineffective for fully disabling AutoRun capabilities on Microsoft Windows systems. Setting the Autorun registry value to 0 will not prevent newly connected devices from automatically running code specified in the Autorun.inf file. It will, however, disable Media Change Notification (MCN) messages, which may prevent Windows from detecting when a CD or DVD is changed. According to Microsoft, setting the NoDriveTypeAutorun registry value to 0xFF "disables Autoplay on all types of drives." Even with this value set, Windows may execute arbitrary code when the user clicks the icon for the device in Windows Explorer.

 

Related Tags

Further Reading: Read and find more news at our news index page.

Do you get our news RSS feed? Get It!

Post a Comment about this news

Latest Tech News Posts

View More News Posts

Latest Downloads

View More Latest Downloads

TweakTown Web Poll

Question: Did EA kill the Battlefield franchise with the terrible BF4 issues?

Yes, Battlefield is doomed

No, Battlefield will live on strong

I'm not sure, but I know EA needs to improve its game

or View the Results

View More Polls

Forum Activity

View More Forum Posts

Press Releases

View More Press Releases
Get TweakTown updates via Facebook!
Just click the "Like" button below